What is a JWT (JSON Web Token)?

JWT (JSON Web Token) is a compact, URL-safe token format used for securely transmitting information between parties. It consists of three parts: header (algorithm and token type), payload (claims/data), and signature (verification). JWTs are commonly used for authentication and information exchange in web applications and APIs.

Is it safe to decode my JWT tokens here?

Yes! All JWT decoding happens entirely in your browser using JavaScript. Your tokens never leave your computer or get sent to any server. However, remember that JWTs are encoded, not encrypted - anyone can decode them. Never put sensitive data in JWT payloads.

What's the difference between encoding and encryption?

JWT uses Base64URL encoding, which is reversible and doesn't provide security - anyone can decode a JWT to see its contents. The signature provides integrity (proving the token hasn't been tampered with), not confidentiality. For sensitive data, use encryption in addition to JWTs.

What algorithms does this JWT debugger support?

Our debugger can decode JWTs signed with any algorithm including HS256, HS384, HS512 (HMAC), RS256, RS384, RS512 (RSA), ES256, ES384, ES512 (ECDSA), and more. The tool displays the algorithm used in the header and can help verify signatures if you provide the secret or public key.

Why can't I verify the signature?

Signature verification requires the secret key (for HMAC algorithms) or public key (for RSA/ECDSA algorithms). For security reasons, you should never share secret keys. This tool can decode and display JWT contents without verification, which is useful for debugging and understanding token structure.

Does this work offline?

Yes! Once you've loaded the page, the JWT debugger works completely offline. You can bookmark this page and decode tokens anytime without an internet connection, ensuring your tokens are never transmitted over the network.

Security Tools

JWT Debugger

Decode and debug JSON Web Tokens (JWT). View headers, payloads, and inspect token structure. All processing happens in your browser.

JWT Token

Decoded Token

Paste a JWT token to see its decoded content

What is JWT?

JSON Web Token (JWT) is a compact, URL-safe means of representing claims between two parties.

Structure

JWTs consist of three parts: Header, Payload, and Signature, separated by dots (.).

Privacy

All decoding happens in your browser. Your tokens are never sent to any server.

How to Use JWT Debugger

Decode and debug JSON Web Tokens in three simple steps

Paste Your JWT Token

Copy your JWT token from your application, API response, or browser storage and paste it into the input field. The token should look like three Base64-encoded strings separated by dots.

View Decoded Content

The tool automatically decodes the JWT and displays the header (algorithm and type) and payload (claims and data) in readable JSON format with syntax highlighting.

Analyze and Debug

Review the decoded information to debug authentication issues, check expiration times, verify claims, or understand the token structure. Optionally verify the signature if you have the secret or public key.

Common Use Cases

Authentication Debugging

Debug authentication issues by examining JWT tokens to verify claims, check expiration times, and validate token structure.

API Development

Inspect JWT tokens used in API requests and responses to ensure correct claims and proper token generation.

Token Validation

Verify JWT token structure and contents before implementing token validation logic in your application.

Security Audits

Analyze JWT tokens during security audits to check for weak algorithms, missing claims, or security vulnerabilities.

SSO Integration

Debug Single Sign-On (SSO) implementations by examining JWT tokens from identity providers like Auth0, Okta, or Azure AD.

Learning & Education

Understand how JWTs work by decoding example tokens and seeing the relationship between encoded and decoded formats.